cloudflare-mcp-smart-proxy 1.5.5 → 1.5.7

package/README.md

@@ -114,8 +114,10 @@ npx -y -p cloudflare-mcp-smart-proxy cloudmcp-connector activate codex \
 - `get_local_memory_target`：读取当前连接器工作空间的本机目标契约。
 - `verify_local_memory_target`：回读验证目标契约或一个精确条目。
 - `capture_memory`：以同一事务写入受治理的 CloudMCP memory plane 和已配置本地目标，双端回读一致后才返回成功。
+- `invalidate_memory`：以 revision、原因和证据软失效一个精确条目，并把同一 canonical JSON 提交到本地与云端。
+- `close_session`：把简洁交接转换为 `working + handoff`，复用与 `capture_memory` 相同的双端事务。
 
-`capture_memory` 只有在当前连接器通过云端鉴权、工具能力授权及精确 `memory_scope` 资源授权后才会被本地协调器暴露。它仍复用原代理的 API Key、设备签名和 CloudMCP 请求路由，不存在匿名云端写入口。
+`capture_memory / invalidate_memory / close_session` 只有在当前连接器通过云端鉴权、对应工具能力授权及精确 `memory_scope` 资源授权后才会被本地协调器暴露。它们仍复用原代理的 API Key、设备签名和 CloudMCP 请求路由，不存在匿名云端写入口。`search_memory / get_memory_entry / load_context` 保持受治理云端只读工具，由同一授权链提供。
 
 本地目录不是硬编码的。以 SoloMap 为目标时，用户或 Agent 可把其记忆根目录显式传给配置工具；未安装 CloudMCP 的 SoloMap 用户继续使用原有 Markdown 机制，公共 SoloMap 插件不会默认依赖这些工具。
 

package/connector-cli.js

@@ -9,6 +9,7 @@ import { reloadCodexMcpServer } from './src/codex-app-server.js';
 import { installReferenceConnector, printReferenceConnectorConfig } from './src/reference-connectors.js';
 import { DeviceIdentity } from './src/device-identity.js';
 import { writeFileAtomically } from './src/reference-connectors.js';
+import { discoverProjectIdentity } from './src/project-identity.js';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
@@ -202,6 +203,7 @@ async function runActivation(options) {
   };
 
   const createApprovalRequest = async ({ replacesRequestId = '' } = {}) => {
+    const projectIdentity = await discoverProjectIdentity(paths.workspaceRoot);
     const requested = await activationFetch(`${paths.cloudUrl}/connectors/activation-requests`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
@@ -211,6 +213,7 @@ async function runActivation(options) {
         publicKeyJwk: device.publicKeyJwk,
         deviceLabel: options['device-label'] || os.hostname(),
         workspaceLabel: path.basename(paths.workspaceRoot),
+        projectIdentity,
         connectorId: options['connector-id'] || defaultConnectorId(options.ecosystem, paths.workspaceRoot)
       })
     });

package/index.js

@@ -38,11 +38,14 @@ function readManagedCredential() {
 const MANAGED_CREDENTIAL = readManagedCredential();
 const CLOUD_URL = MANAGED_CREDENTIAL?.cloudUrl || process.env.CLOUDFLARE_MCP_URL || process.env.MCP_URL;
 const CLOUD_API_KEY = MANAGED_CREDENTIAL?.apiKey || process.env.CLOUDFLARE_MCP_API_KEY || process.env.MCP_API_KEY;
-const WORKSPACE_ROOT = process.env.WORKSPACE_ROOT || process.cwd();
+const FIXED_PROJECT_CONTEXT = process.env.CLOUDMCP_FIXED_PROJECT_CONTEXT === 'true';
+const WORKSPACE_ROOT = FIXED_PROJECT_CONTEXT ? (process.env.WORKSPACE_ROOT || process.cwd()) : process.cwd();
 const CLIENT_PROFILE_ID = MANAGED_CREDENTIAL?.clientProfileId || process.env.CLOUDMCP_CLIENT_PROFILE_ID || process.env.CLIENT_PROFILE_ID || '';
 const CONNECTOR_ID = MANAGED_CREDENTIAL?.connectorId || process.env.CLOUDMCP_CONNECTOR_ID || process.env.CONNECTOR_ID || '';
 const CONNECTOR_TYPE = MANAGED_CREDENTIAL?.connectorType || process.env.CLOUDMCP_CONNECTOR_TYPE || process.env.CONNECTOR_TYPE || 'smart_proxy';
-const WORKSPACE_ID = MANAGED_CREDENTIAL?.workspaceId || process.env.CLOUDMCP_WORKSPACE_ID || process.env.WORKSPACE_ID || '';
+const WORKSPACE_ID = FIXED_PROJECT_CONTEXT
+  ? (process.env.CLOUDMCP_WORKSPACE_ID || process.env.WORKSPACE_ID || '')
+  : '';
 const DEVICE_IDENTITY_PATH = process.env.CLOUDMCP_DEVICE_IDENTITY_PATH || '';
 const AUTO_SYNC_PROFILE = (process.env.CLOUDMCP_AUTO_SYNC_PROFILE || 'true') !== 'false';
 const AUTO_APPLY_BRAIN = (process.env.CLOUDMCP_AUTO_APPLY_BRAIN || 'true') !== 'false';
@@ -77,7 +80,14 @@ const memoryCoordinator = new LocalMemoryCoordinator({
   connectorId: CONNECTOR_ID
 });
 const localTools = new LocalToolExecutor(WORKSPACE_ROOT, connectorBridge, memoryCoordinator);
-const router = new SmartRouter(CLOUD_URL, CLOUD_API_KEY, localTools, WORKSPACE_ROOT, connectorBridge.deviceIdentity);
+const router = new SmartRouter(
+  CLOUD_URL,
+  CLOUD_API_KEY,
+  localTools,
+  WORKSPACE_ROOT,
+  connectorBridge.deviceIdentity,
+  () => connectorBridge.getScopeHeaders()
+);
 localTools.setCloudToolCaller((tool, params) => router.callCloudTool(tool, params));
 
 // 创建 MCP 服务器
@@ -163,7 +173,8 @@ server.setRequestHandler(ListPromptsRequestSchema, async () => {
       method: 'POST',
       headers: {
         'Authorization': `Bearer ${CLOUD_API_KEY}`,
-        'Content-Type': 'application/json'
+        'Content-Type': 'application/json',
+        ...connectorBridge.getScopeHeaders()
       },
       body: JSON.stringify({
         jsonrpc: '2.0',
@@ -199,7 +210,8 @@ server.setRequestHandler(GetPromptRequestSchema, async (request) => {
       method: 'POST',
       headers: {
         'Authorization': `Bearer ${CLOUD_API_KEY}`,
-        'Content-Type': 'application/json'
+        'Content-Type': 'application/json',
+        ...connectorBridge.getScopeHeaders()
       },
       body: JSON.stringify({
         jsonrpc: '2.0',
@@ -240,18 +252,22 @@ server.setRequestHandler(GetPromptRequestSchema, async (request) => {
 // 启动服务器
 async function main() {
   try {
-    const transport = new StdioServerTransport();
-    await server.connect(transport);
-    console.error('Cloudflare MCP Smart Proxy started');
-    console.error(`Workspace root: ${WORKSPACE_ROOT}`);
-    console.error(`Cloud URL: ${CLOUD_URL}`);
+    let bridgeStatus = null;
     if (connectorBridge.isConfigured()) {
-      const bridgeStatus = await connectorBridge.initialize({
+      bridgeStatus = await connectorBridge.initialize({
         autoApplyBrain: AUTO_APPLY_BRAIN,
         autoSyncProfile: AUTO_SYNC_PROFILE,
         autoReportProjectProbe: AUTO_REPORT_PROJECT_PROBE,
         autoGenerateContextPack: AUTO_GENERATE_CONTEXT_PACK
       });
+      memoryCoordinator.workspaceId = connectorBridge.workspaceId;
+    }
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    console.error('Cloudflare MCP Smart Proxy started');
+    console.error(`Workspace root: ${WORKSPACE_ROOT}`);
+    console.error(`Cloud URL: ${CLOUD_URL}`);
+    if (bridgeStatus) {
       console.error(`Connector bridge profile: ${bridgeStatus.clientProfileId}`);
       console.error(`Connector bridge workspace: ${bridgeStatus.workspaceId}`);
       const applyResult = bridgeStatus.state?.lastBrainApplyResult;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cloudflare-mcp-smart-proxy",
-  "version": "1.5.5",
+  "version": "1.5.7",
   "description": "Smart proxy for Cloudflare MCP - routes tools to cloud or local execution",
   "repository": {
     "type": "git",

package/src/cloud-client.js

@@ -1,10 +1,11 @@
 const CONNECTOR_CONTRACT_VERSION = 'a2.v1';
 
 export class CloudClient {
-  constructor({ cloudUrl, cloudApiKey, deviceIdentity = null }) {
+  constructor({ cloudUrl, cloudApiKey, deviceIdentity = null, getScopeHeaders = null }) {
     this.cloudUrl = String(cloudUrl || '').replace(/\/$/, '');
     this.cloudApiKey = cloudApiKey || '';
     this.deviceIdentity = deviceIdentity;
+    this.getScopeHeaders = typeof getScopeHeaders === 'function' ? getScopeHeaders : () => ({});
     if (!this.cloudUrl) {
       throw new Error('cloudUrl is required');
     }
@@ -42,6 +43,7 @@ export class CloudClient {
         'Authorization': `Bearer ${this.cloudApiKey}`,
         'Content-Type': 'application/json',
         'X-CloudMCP-Connector-Contract-Version': CONNECTOR_CONTRACT_VERSION,
+        ...this.getScopeHeaders(),
         ...signedHeaders,
         ...(idempotencyKey ? { 'X-Idempotency-Key': idempotencyKey } : {})
       },
@@ -73,6 +75,13 @@ export class CloudClient {
     });
   }
 
+  async resolveWorkspace({ projectIdentity }) {
+    return this.request('/connectors/workspace-resolution', {
+      method: 'POST',
+      body: { projectIdentity }
+    });
+  }
+
   async listConnectorStatusReports({ clientProfileId, workspaceId, connectorId, limit = 5 }) {
     return this.request('/connectors/status-reports', {
       query: { clientProfileId, workspaceId, connectorId, limit }

package/src/connector-bridge.js

@@ -1,9 +1,9 @@
 import os from 'os';
-import path from 'path';
 import { CloudClient } from './cloud-client.js';
 import { DeviceIdentity } from './device-identity.js';
 import { discoverProjectProbe } from './project-probe-discovery.js';
 import { detectIde, applyBrainSnapshot } from './ide-configurator.js';
+import { discoverProjectIdentity } from './project-identity.js';
 
 function normalizeString(value, fallback = '') {
   const normalized = typeof value === 'string' ? value.trim() : '';
@@ -14,10 +14,6 @@ function defaultConnectorId() {
   return `connector.${os.hostname().replace(/[^a-zA-Z0-9_.-]/g, '_')}.local`;
 }
 
-function defaultWorkspaceId(workspaceRoot) {
-  return `workspace.${path.basename(workspaceRoot || process.cwd()).replace(/[^a-zA-Z0-9_.-]/g, '_')}`;
-}
-
 function buildIdempotencyKey(...parts) {
   return parts
     .map((entry) => normalizeString(entry))
@@ -42,12 +38,13 @@ export class ConnectorBridge {
     this.clientProfileId = normalizeString(clientProfileId);
     this.connectorId = normalizeString(connectorId, defaultConnectorId());
     this.connectorType = normalizeString(connectorType, 'smart_proxy');
-    this.workspaceId = normalizeString(workspaceId, defaultWorkspaceId(this.workspaceRoot));
+    this.workspaceId = normalizeString(workspaceId);
     this.deviceIdentity = deviceIdentity || new DeviceIdentity({ identityPath: deviceIdentityPath });
     this.cloudClient = cloudClient || new CloudClient({
       cloudUrl,
       cloudApiKey,
-      deviceIdentity: this.deviceIdentity
+      deviceIdentity: this.deviceIdentity,
+      getScopeHeaders: () => this.getScopeHeaders()
     });
     this.state = {
       initializedAt: Date.now(),
@@ -66,6 +63,27 @@ export class ConnectorBridge {
     return Boolean(this.clientProfileId);
   }
 
+  getScopeHeaders() {
+    return {
+      ...(this.workspaceId ? { 'X-CloudMCP-Workspace-ID': this.workspaceId } : {}),
+      ...(this.clientProfileId ? { 'X-CloudMCP-Client-Profile-ID': this.clientProfileId } : {}),
+      ...(this.connectorId ? { 'X-CloudMCP-Connector-ID': this.connectorId } : {})
+    };
+  }
+
+  async resolveCurrentWorkspace() {
+    const projectIdentity = await discoverProjectIdentity(this.workspaceRoot);
+    const response = await this.cloudClient.resolveWorkspace({ projectIdentity });
+    const resolution = response?.workspaceResolution;
+    if (!resolution?.workspaceId) {
+      throw new Error('CloudMCP did not resolve a workspace for the current project');
+    }
+    this.workspaceId = resolution.workspaceId;
+    this.state.projectIdentity = projectIdentity;
+    this.state.workspaceResolution = resolution;
+    return resolution;
+  }
+
   getBridgeStatus() {
     return {
       objectType: 'connector_bridge_status',
@@ -89,6 +107,7 @@ export class ConnectorBridge {
       return this.getBridgeStatus();
     }
 
+    await this.resolveCurrentWorkspace();
     try {
       if (typeof this.cloudClient?.registerDevice === 'function') {
         await this.ensureDeviceRegistration();

package/src/local-memory-coordinator.js

@@ -10,13 +10,6 @@ import {
   validateMemoryIdentifier
 } from './memory-schema.js';
 
-const SENSITIVE_MEMORY_PATTERNS = [
-  /-----BEGIN [A-Z ]*PRIVATE KEY-----/i,
-  /\bCLOUDMCP_APPROVAL_CODE\s*=/i,
-  /\b(?:api[_ -]?key|access[_ -]?token|client[_ -]?secret|private[_ -]?key)\s*[:=]\s*\S{12,}/i,
-  /\bmcp_[A-Za-z0-9]{16,}\b/
-];
-
 function writeJsonAtomically(filePath, value, mode = 0o600) {
   fs.mkdirSync(path.dirname(filePath), { recursive: true });
   const temporaryPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
@@ -65,12 +58,6 @@ function currentGitCommit(workspaceRoot) {
   }
 }
 
-function assertNoSensitiveMemory(input) {
-  const text = [input.title, input.content, ...(input.evidenceRefs || [])].filter(Boolean).join('\n');
-  if (SENSITIVE_MEMORY_PATTERNS.some((pattern) => pattern.test(text))) {
-    throw new Error('Memory content appears to contain a secret or approval credential');
-  }
-}
 
 export class LocalMemoryCoordinator {
   constructor(options = {}) {
@@ -200,7 +187,6 @@ export class LocalMemoryCoordinator {
     const contract = this.getContract();
     if (!contract || contract.status !== 'active') throw new Error('Local memory target is not configured');
     const input = validateMemoryCaptureInput(params);
-    assertNoSensitiveMemory(input);
     const requestedScope = params.memory_scope_id || params.memoryScopeId || '';
     if (requestedScope && !contract.cloudScopeIds.includes(requestedScope)) {
       throw new Error(`Memory scope is not authorized by the local target contract: ${requestedScope}`);
@@ -332,4 +318,75 @@ export class LocalMemoryCoordinator {
       );
     }
   }
+
+  async invalidate(params = {}) {
+    const contract = this.getContract();
+    if (!contract || contract.status !== 'active') throw new Error('Local memory target is not configured');
+    const memoryId = validateMemoryIdentifier(params.memory_id || params.memoryId, 'memory_id');
+    const requestedScope = params.memory_scope_id || params.memoryScopeId || '';
+    if (requestedScope && !contract.cloudScopeIds.includes(requestedScope)) {
+      throw new Error(`Memory scope is not authorized by the local target contract: ${requestedScope}`);
+    }
+    let stage = 'cloud_write';
+    try {
+      const result = await this.callCloud('invalidate_memory', {
+        memory_scope_id: requestedScope || undefined,
+        memory_id: memoryId,
+        expected_revision: params.expected_revision || params.expectedRevision,
+        reason: params.reason,
+        evidence_refs: params.evidence_refs || params.evidenceRefs
+      });
+      if (result?.verified !== true) throw new Error(`Cloud memory did not confirm invalidation readback: ${memoryId}`);
+      const entry = assertMemoryEntryIntegrity(result.entry);
+      if (!contract.cloudScopeIds.includes(entry.scopeId) || entry.status !== 'invalidated') {
+        throw new Error(`CloudMCP returned an invalid memory invalidation: ${memoryId}`);
+      }
+      stage = 'local_write';
+      const entryPath = path.join(contract.directory, 'entries', `${entry.id}.json`);
+      writeJsonAtomically(entryPath, entry);
+      stage = 'local_readback';
+      const localEntry = assertMemoryEntryIntegrity(readJson(entryPath));
+      if (canonicalMemoryJson(localEntry) !== canonicalMemoryJson(entry)) {
+        throw new Error(`Local memory invalidation readback failed for ${entry.id}`);
+      }
+      return {
+        success: true,
+        memoryId: entry.id,
+        revision: entry.revision,
+        canonicalHash: entry.canonicalHash,
+        idempotent: result.idempotent === true,
+        local: { persisted: true, verified: true },
+        cloud: { persisted: true, verified: true },
+        entry
+      };
+    } catch (error) {
+      const cloudStatus = stage === 'cloud_write' ? 'unknown' : 'verified';
+      const localStatus = stage === 'cloud_write' ? 'not_started' : (stage === 'local_write' ? 'failed' : 'persisted_unverified');
+      throw new Error(
+        `Memory invalidation ${memoryId} failed at ${stage} `
+        + `(cloud=${cloudStatus}, local=${localStatus}): ${error?.message || 'unknown error'}`
+      );
+    }
+  }
+
+  async closeSession(params = {}) {
+    const summary = typeof params.summary === 'string' ? params.summary.trim() : '';
+    if (!summary) throw new Error('summary is required');
+    const nextSteps = (Array.isArray(params.next_steps) ? params.next_steps : [])
+      .map((step) => String(step).trim())
+      .filter(Boolean);
+    const content = nextSteps.length
+      ? `${summary}\n\nNext steps:\n${nextSteps.map((step) => `- ${String(step).trim()}`).join('\n')}`
+      : summary;
+    const captured = await this.capture({
+      memory_scope_id: params.memory_scope_id || params.memoryScopeId,
+      layer: 'working',
+      kind: 'handoff',
+      title: params.title || 'Session handoff',
+      content,
+      tags: params.tags,
+      transaction_id: params.transaction_id || params.transactionId
+    });
+    return { ...captured, closed: true };
+  }
 }

package/src/local-tools.js

@@ -97,6 +97,14 @@ export class LocalToolExecutor {
       case 'capture_memory':
         if (!this.memoryCoordinator) throw new Error('Local memory coordinator is not configured');
         return await this.memoryCoordinator.capture(params || {});
+
+      case 'invalidate_memory':
+        if (!this.memoryCoordinator) throw new Error('Local memory coordinator is not configured');
+        return await this.memoryCoordinator.invalidate(params || {});
+
+      case 'close_session':
+        if (!this.memoryCoordinator) throw new Error('Local memory coordinator is not configured');
+        return await this.memoryCoordinator.closeSession(params || {});
       
       default:
         throw new Error(`Unknown local tool: ${toolName}`);
@@ -136,7 +144,7 @@ export class LocalToolExecutor {
       },
       {
         name: 'capture_memory',
-        description: 'Validate one memory and commit the same JSON entry to the configured local target and governed CloudMCP memory scope.',
+        description: 'Validate one governed memory and commit the same canonical JSON entry to the configured local target and CloudMCP scope.',
         inputSchema: {
           type: 'object',
           properties: {
@@ -158,6 +166,37 @@ export class LocalToolExecutor {
           required: ['content']
         }
       },
+      {
+        name: 'invalidate_memory',
+        description: 'Soft-invalidate one governed memory and verify the same canonical result in CloudMCP and the configured local target.',
+        inputSchema: {
+          type: 'object',
+          properties: {
+            memory_scope_id: { type: 'string' },
+            memory_id: { type: 'string' },
+            expected_revision: { type: 'number' },
+            reason: { type: 'string' },
+            evidence_refs: { type: 'array', items: { type: 'string' } }
+          },
+          required: ['memory_id', 'expected_revision', 'reason', 'evidence_refs']
+        }
+      },
+      {
+        name: 'close_session',
+        description: 'Persist a working handoff through the same verified local-and-cloud memory transaction.',
+        inputSchema: {
+          type: 'object',
+          properties: {
+            memory_scope_id: { type: 'string' },
+            title: { type: 'string' },
+            summary: { type: 'string' },
+            next_steps: { type: 'array', items: { type: 'string' } },
+            tags: { type: 'array', items: { type: 'string' } },
+            transaction_id: { type: 'string' }
+          },
+          required: ['summary']
+        }
+      },
       {
         name: 'read_file',
         description: 'Read a file from local filesystem',

package/src/memory-schema.js

@@ -5,6 +5,17 @@ const MEMORY_KINDS = new Set([
   'preference', 'rule', 'project_fact', 'decision', 'pattern', 'domain', 'handoff', 'observation'
 ]);
 const MEMORY_IDENTIFIER_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+const MEMORY_KIND_LAYERS = new Map([
+  ['preference', 'stable'], ['rule', 'stable'], ['project_fact', 'stable'],
+  ['decision', 'stable'], ['pattern', 'stable'], ['domain', 'stable'],
+  ['handoff', 'working'], ['observation', 'candidate']
+]);
+const SENSITIVE_MEMORY_PATTERNS = [
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----/i,
+  /\bCLOUDMCP_APPROVAL_CODE\s*=/i,
+  /\b(?:api[_ -]?key|access[_ -]?token|client[_ -]?secret|private[_ -]?key)\s*[:=]\s*\S{12,}/i,
+  /\bmcp_[A-Za-z0-9]{16,}\b/
+];
 
 function normalizeString(value, fallback = null) {
   const normalized = typeof value === 'string' ? value.trim() : '';
@@ -28,6 +39,14 @@ function normalizeStringArray(value, limit = 32) {
   ));
 }
 
+export function assertNoSensitiveMemory(input = {}) {
+  const text = [input.title, input.content, ...(input.evidenceRefs || input.evidence_refs || [])]
+    .filter(Boolean).join('\n');
+  if (SENSITIVE_MEMORY_PATTERNS.some((pattern) => pattern.test(text))) {
+    throw new Error('Memory content appears to contain a secret or approval credential');
+  }
+}
+
 function sortValue(value) {
   if (Array.isArray(value)) return value.map(sortValue);
   if (!value || typeof value !== 'object') return value;
@@ -58,15 +77,18 @@ export function validateMemoryCaptureInput(payload = {}) {
   if (content.length > 12000) throw new Error('Memory content exceeds 12000 characters');
   if (title && title.length > 240) throw new Error('Memory title exceeds 240 characters');
   const layer = normalizeString(payload.layer, 'candidate');
+  if (layer === 'stable' && !normalizeString(payload.kind)) throw new Error('Stable memory requires an explicit kind');
   const kind = normalizeString(payload.kind, layer === 'working' ? 'handoff' : 'observation');
   if (!MEMORY_LAYERS.has(layer)) throw new Error(`Unsupported memory layer: ${layer}`);
   if (!MEMORY_KINDS.has(kind)) throw new Error(`Unsupported memory kind: ${kind}`);
+  const requiredLayer = MEMORY_KIND_LAYERS.get(kind);
+  if (requiredLayer !== layer) throw new Error(`Memory kind ${kind} must use the ${requiredLayer} layer`);
   const evidenceRefs = normalizeStringArray(payload.evidence_refs || payload.evidenceRefs, 20);
   const verifiedAt = normalizeIsoDate(payload.verified_at || payload.verifiedAt);
-  if (layer === 'stable' && evidenceRefs.length === 0 && !verifiedAt) {
-    throw new Error('Stable memory requires evidence_refs or verified_at');
+  if (layer === 'stable' && evidenceRefs.length === 0) {
+    throw new Error('Stable memory requires at least one evidence_ref');
   }
-  return {
+  const normalized = {
     title: title || 'Untitled memory',
     content,
     layer,
@@ -79,6 +101,8 @@ export function validateMemoryCaptureInput(payload = {}) {
     supersedes: normalizeStringArray(payload.supersedes, 20)
       .map((id) => validateMemoryIdentifier(id, 'supersedes entry id'))
   };
+  assertNoSensitiveMemory(normalized);
+  return normalized;
 }
 
 export function assertMemoryEntryIntegrity(entry) {

package/src/project-identity.js

@@ -0,0 +1,75 @@
+import fs from 'fs/promises';
+import path from 'path';
+
+function normalizeString(value, fallback = '') {
+  const normalized = typeof value === 'string' ? value.trim() : '';
+  return normalized || fallback;
+}
+
+function normalizeAlias(value) {
+  return normalizeString(value)
+    .toLowerCase()
+    .replace(/\.git$/i, '')
+    .replace(/\/+$/, '');
+}
+
+function normalizeGitRemote(value) {
+  const remote = normalizeString(value);
+  if (!remote) return '';
+  const scpMatch = remote.match(/^(?:[^@]+@)?([^:]+):(.+)$/);
+  if (scpMatch && !remote.includes('://')) {
+    return normalizeAlias(`${scpMatch[1]}/${scpMatch[2]}`);
+  }
+  try {
+    const parsed = new URL(remote);
+    return normalizeAlias(`${parsed.hostname}${parsed.pathname}`);
+  } catch {
+    return normalizeAlias(remote);
+  }
+}
+
+async function readText(filePath) {
+  try {
+    return await fs.readFile(filePath, 'utf8');
+  } catch {
+    return '';
+  }
+}
+
+async function readPackageName(repoRoot) {
+  try {
+    const payload = JSON.parse(await fs.readFile(path.join(repoRoot, 'package.json'), 'utf8'));
+    return normalizeAlias(payload?.name);
+  } catch {
+    return '';
+  }
+}
+
+async function readGitRemote(repoRoot) {
+  const gitConfig = await readText(path.join(repoRoot, '.git', 'config'));
+  const originSection = gitConfig.match(/\[remote\s+"origin"\]([\s\S]*?)(?=\n\[|$)/i)?.[1] || '';
+  const originUrl = originSection.match(/^\s*url\s*=\s*(.+)$/mi)?.[1] || '';
+  return normalizeGitRemote(originUrl);
+}
+
+export async function discoverProjectIdentity(workspaceRoot = process.cwd()) {
+  const repoRoot = path.resolve(workspaceRoot || process.cwd());
+  const repoName = path.basename(repoRoot);
+  const [gitRemote, packageName] = await Promise.all([
+    readGitRemote(repoRoot),
+    readPackageName(repoRoot)
+  ]);
+  const aliases = Array.from(new Set([
+    gitRemote ? `git:${gitRemote}` : '',
+    packageName ? `package:${packageName}` : '',
+    `repo:${normalizeAlias(repoName)}`
+  ].filter(Boolean)));
+
+  return {
+    canonicalId: aliases[0],
+    aliases,
+    repoName,
+    gitRemote: gitRemote || null,
+    packageName: packageName || null
+  };
+}

package/src/reference-connectors.js

@@ -100,7 +100,8 @@ function toManagedEnv({
   connectorType,
   workspaceId,
   deviceIdentityPath,
-  codexConfigPath
+  codexConfigPath,
+  fixedProjectContext = false
 }) {
   const env = {
     CLOUDFLARE_MCP_URL: normalizeEnvValue(cloudUrl),
@@ -112,7 +113,8 @@ function toManagedEnv({
     CLOUDMCP_CONNECTOR_TYPE: normalizeEnvValue(connectorType),
     CLOUDMCP_WORKSPACE_ID: normalizeEnvValue(workspaceId),
     CLOUDMCP_DEVICE_IDENTITY_PATH: normalizeEnvValue(deviceIdentityPath),
-    CODEX_SHARED_CONFIG_PATH: normalizeEnvValue(codexConfigPath)
+    CODEX_SHARED_CONFIG_PATH: normalizeEnvValue(codexConfigPath),
+    CLOUDMCP_FIXED_PROJECT_CONTEXT: fixedProjectContext ? 'true' : ''
   };
 
   return Object.fromEntries(
@@ -156,6 +158,7 @@ export function buildReferenceConnectorServer({
   workspaceId = '',
   deviceIdentityPath = '',
   codexConfigPath = '',
+  fixedProjectContext = true,
   packageRoot = null,
   runtime = 'npm'
 }) {
@@ -174,13 +177,14 @@ export function buildReferenceConnectorServer({
       cloudUrl,
       cloudApiKey,
       credentialPath,
-      workspaceRoot: resolvedWorkspaceRoot,
+      workspaceRoot: fixedProjectContext ? resolvedWorkspaceRoot : '',
       clientProfileId,
       connectorId: resolvedConnectorId,
       connectorType: resolvedConnectorType,
-      workspaceId: resolvedWorkspaceId,
+      workspaceId: fixedProjectContext ? resolvedWorkspaceId : '',
       deviceIdentityPath,
-      codexConfigPath: normalizedEcosystem === 'codex' ? codexConfigPath : ''
+      codexConfigPath: normalizedEcosystem === 'codex' ? codexConfigPath : '',
+      fixedProjectContext
     }),
     enabled: true,
     startupTimeoutSec: normalizedEcosystem === 'codex' ? DEFAULT_CODEX_STARTUP_TIMEOUT_SEC : null,
@@ -358,6 +362,7 @@ export function installReferenceConnector({
     workspaceId,
     deviceIdentityPath,
     codexConfigPath: target.ecosystem === 'codex' ? target.targetFile : '',
+    fixedProjectContext: target.scope === 'project',
     packageRoot,
     runtime
   });

package/src/router.js

@@ -38,12 +38,13 @@ export function sanitizeProxyError(error, params = {}) {
 }
 
 export class SmartRouter {
-  constructor(cloudUrl, cloudApiKey, localTools, workspaceRoot = null, deviceIdentity = null) {
+  constructor(cloudUrl, cloudApiKey, localTools, workspaceRoot = null, deviceIdentity = null, getScopeHeaders = null) {
     this.cloudUrl = cloudUrl.replace(/\/$/, ''); // 移除尾部斜杠
     this.cloudApiKey = cloudApiKey;
     this.localTools = localTools;
     this.workspaceRoot = workspaceRoot || process.cwd();
     this.deviceIdentity = deviceIdentity;
+    this.getScopeHeaders = typeof getScopeHeaders === 'function' ? getScopeHeaders : () => ({});
     
     // 工具路由规则
     this.routingRules = {
@@ -72,7 +73,9 @@ export class SmartRouter {
         'configure_local_memory_target',
         'get_local_memory_target',
         'verify_local_memory_target',
-        'capture_memory'
+        'capture_memory',
+        'invalidate_memory',
+        'close_session'
       ],
       
       // 云端工具（需要网络或云端资源）
@@ -213,6 +216,7 @@ export class SmartRouter {
         headers: {
           'Authorization': `Bearer ${this.cloudApiKey}`,
           'Content-Type': 'application/json',
+          ...this.getScopeHeaders(),
           ...signedHeaders
         },
         body
@@ -294,7 +298,10 @@ export class SmartRouter {
     }
 
     const cloudNames = new Set(cloudTools.map((tool) => tool.name));
-    const eligibleLocalTools = localTools.filter((tool) => tool.name !== 'capture_memory' || cloudNames.has('capture_memory'));
+    const governedLocalMemoryTools = new Set(['capture_memory', 'invalidate_memory', 'close_session']);
+    const eligibleLocalTools = localTools.filter((tool) => (
+      !governedLocalMemoryTools.has(tool.name) || cloudNames.has(tool.name)
+    ));
     const localNames = new Set(eligibleLocalTools.map((tool) => tool.name));
     return [
       ...cloudTools.filter((tool) => !localNames.has(tool.name)).map((tool) => ({ ...tool, source: 'cloud' })),
@@ -320,6 +327,7 @@ export class SmartRouter {
         headers: {
           'Authorization': `Bearer ${this.cloudApiKey}`,
           'Content-Type': 'application/json',
+          ...this.getScopeHeaders(),
           ...signedHeaders
         },
         body